Redirection page google et blocage connexion

Question

Bonjour,

J'ai un petit problème de rien du tout mes pages google sont redirigées, j'ai un icone qui revient souvent même après avoir été supprimé par Fileassassin et Unlocker et au bout d'environ 10 minutes je ne peux même plus accéder à internet il me dise :

 "  Connexion interrompu  La connexion avec le serveur a été réinitialisé pendant le chargement de la page. La liaison au réseau a été interrompu pendant la négociation d'une connexion. Veuillez ressayer. "

J'ai fait un scan avec Hitman Pro qui a duré très longtemps mais n'a rien donné, j'ai fait un scan avec Avira Antivirus toujours rien, avec A2free toujours rien (enfin si sa ma supprimer des truck pas cool mais sa n'a pas reglé mon problème T.T).

Ensuite j'ai utiliser FixWareout, Hijackthis et Smitfraudfix ainsi que Hoster.
Les logs sont les suivants:

===>>>Pour Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:38:14, on 20/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\PC Accelerator 2007\deskxl.exe
D:\Program Files\PC Accelerator 2007\pcperf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.carrefour.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: AdvancedAdvisor - {7141E838-7BE0-F63D-6939-29A2CC9FBB15} - C:\Program Files\AdvancedAdvisor\AdvancedAdvisor-2.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeskAccelerator] "D:\Program Files\PC Accelerator 2007\deskxl.exe"
O4 - HKLM\..\Run: [PCPerf] "D:\Program Files\PC Accelerator 2007\pcperf.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ISTray] "D:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour.fr/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

benurrr · Answer

salut ben ton rapport est propre a part quelque no file et file missing a fixer 

par precaution tu va telecharger sdfix et malwarbyte

telecharge malwarbyte http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware

 a l'intallation verifie que mise a jour et scan complet sont bien cocher 

Une fois a jour, le programme va se lancer; 

et la tu l'arrete tu ne lance pas maintenant car je voudrait que tu le fassent ont mode sans echec car beaucoup plus efficace

A la fin du scan clique sur Afficher les résultats 

Suppression des éléments détectés >>>> clique sur Supprimer la sélection ou supprimer tout 
S'il t'es demandé de redémarrer >>> clique sur "Yes" 

comment demarer on mode sans echec içi tuto http://www.infos-du-net.com/forum/272325-11-tuto-demarrer-mode-echec

tu enregistre le raport generer de facon a le retrouver et tu poste le nouveau rapport raport


1) Télécharge SDFix d' AndyManchesta 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe sur ton Bureau. 

Double clique sur SDFix.exe et choisis Install. L'outil sera extrait à la racine du lecteur système (généralement le C:\) 
N y touche pas pour l instant. 

2) Redémarre en mode sans échec 

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut. 

3) SDFix 
* Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
* Appuie sur Y pour commencer le processus de nettoyage. 
* Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 

* Appuie sur une touche pour redémarrer le PC. 
* Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 

* Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
· Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
et tu telecharge sdfix

Ben1er · Answer

Merci beaucoup pour ton aide je n’ai plus de redirection mais je ne peux accéder que pendant une courte durée ensuite il (Mozilla Firefox) se met à charger longtemps les pages et à afficher la même chose qu’avant. Le truck c’est que les autres logiciel (Outlook mon anti-virus etc…) on accès à internet puisque je peux recevoir mes messages et des mise à jours… 
Je poste mes logs afin qu’il t’aide :

===>>> Pour SDFIX:


[b]SDFix: Version 1.227 [/b]
Run by Benjamin on 20/09/2008 at 19:57

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Rootkit Found :
C:\WINDOWS\system32\drivers	dssserv.sys - Rootkit.Win32.Agent.cku

[b]Name [/b]: z
tdssserv

[b]Path [/b]:
\systemroot\system32\drivers\TDSSserv.sys 

tdssserv - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\Documents and Settings\Benjamin\Mes documents\My Documents.url - Deleted
C:\Documents and Settings\Benjamin\Mes documents\Ma musique\My Music.url - Deleted
C:\Documents and Settings\Benjamin\Mes documents\Mes images\My Pictures.url - Deleted
C:\Documents and Settings\Benjamin\Mes documents\Mes vid‚os\My Video.url - Deleted
C:\Documents and Settings\Benjamin\Bureau\Casino.url - Deleted
C:\WINDOWS\system32\windows_update.exe - Deleted
C:\WINDOWS\system32\drivers	dssserv.sys  - Deleted
C:\WINDOWS\system32	dsspopup.dll  - Deleted
C:\WINDOWS\system32	dsspopup1.url  - Deleted
C:\WINDOWS\system32	dsspopup2.url  - Deleted
C:\WINDOWS\system32	dsspopup3.url  - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-20 21:23:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0050f27d7901]
"000fde0e8ffc"=hex:b1,60,60,0e,a7,25,e1,e4,28,4e,a0,b3,1a,a0,57,a9
"001963308f6a"=hex:8b,d5,ea,b6,74,c3,b3,85,2f,12,ba,4b,f9,64,c9,19
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:62,f8,87,c7,a6,13,f5,17,04,4c,67,fb,26,5a,89,08,6c,08,d8,dd,82,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,a0,66,36,bb,70,08,eb,c9,d0,80,de,34,f4,8e,be,b7,36,..
"khjeh"=hex:cb,e0,de,9c,da,43,56,6d,7d,b0,01,74,ae,1d,2d,36,9a,34,a5,51,0e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:45,56,66,48,9e,e3,b4,d9,23,11,6b,06,fc,52,d1,20,6a,2f,0f,62,78,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0050f27d7901]
"000fde0e8ffc"=hex:b1,60,60,0e,a7,25,e1,e4,28,4e,a0,b3,1a,a0,57,a9
"001963308f6a"=hex:8b,d5,ea,b6,74,c3,b3,85,2f,12,ba,4b,f9,64,c9,19
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:62,f8,87,c7,a6,13,f5,17,04,4c,67,fb,26,5a,89,08,6c,08,d8,dd,82,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,a0,66,36,bb,70,08,eb,c9,d0,80,de,34,f4,8e,be,b7,36,..
"khjeh"=hex:cb,e0,de,9c,da,43,56,6d,7d,b0,01,74,ae,1d,2d,36,9a,34,a5,51,0e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:45,56,66,48,9e,e3,b4,d9,23,11,6b,06,fc,52,d1,20,6a,2f,0f,62,78,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:enabled:Assistance … distance"
"C:\Program Files\AOL 9.0\AOL.exe"="C:\Program Files\AOL 9.0\AOL.exe:*:enabled:AOL 9.0"
"C:\Program Files\AOL 9.0\WAOL.exe"="C:\Program Files\AOL 9.0\WAOL.exe:*:enabled:AOL 9.0"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLACSD.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLACSD.exe:*:enabled:AOL 9.0 (Connectivity Service)"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDIAL.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDIAL.exe:*:enabled:AOL 9.0 (Connectivity Service Dialer)"
"C:\WINDOWS\system32\fxsclnt.exe"="C:\WINDOWS\system32\fxsclnt.exe:*:enabled:Microsoft Fax"
"C:\Program Files\CA\eTrust Antivirus\InocIT.exe"="C:\Program Files\CA\eTrust Antivirus\InocIT.exe:*:enabled:eTrust Antivirus - Local Scanner"
"C:\Program Files\CA\eTrust Antivirus\Realmon.exe"="C:\Program Files\CA\eTrust Antivirus\Realmon.exe:*:enabled:eTrust Antivirus - Realtime monitor"
"C:\Program Files\CA\eTrust Antivirus\InoRpc.exe"="C:\Program Files\CA\eTrust Antivirus\InoRpc.exe:*:enabled:eTrust Antivirus - RPC Server"
"C:\Program Files\NetMeeting\Conf.exe"="C:\Program Files\NetMeeting\Conf.exe:*:enabled:NetMeeting"
"C:\Program Files\Ahead\Nero MediaHome\NeroMediaHome.exe"="C:\Program Files\Ahead\Nero MediaHome\NeroMediaHome.exe:*:enabled:Nero MediaHome"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe"="C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:*:Enabled:Star Wars: Empire at War"
"C:\Program Files\Ubisoft\Tom Clancy's Splinter Cell Chaos Theory\System\splintercell3.exe"="C:\Program Files\Ubisoft\Tom Clancy's Splinter Cell Chaos Theory\System\splintercell3.exe:*:Enabled:splintercell3"
"C:\Program Files\JVTorrent\btdownloadgui.exe"="C:\Program Files\JVTorrent\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\Program Files\Microsoft Games\Age of Empires III\age3.exe"="C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:*:Enabled:Age of Empires 3"
"C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE"="C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE:*:Enabled:ACTOFWAR"
"C:\Program Files\Atari\Act of War - Direct Action\fpupdate.exe"="C:\Program Files\Atari\Act of War - Direct Action\fpupdate.exe:*:Enabled:fpupdate"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\Codemasters\Perimeter\perimeter.exe"="C:\Program Files\Codemasters\Perimeter\perimeter.exe:*:Enabled:Perimeter"
"C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe"="C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"
"C:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat"="C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat:*:Enabled:La Bataille pour la Terre du Milieu(tm)"
"C:\Program Files\Microsoft Games\Halo Trial\halo.exe"="C:\Program Files\Microsoft Games\Halo Trial\halo.exe:*:Enabled:Halo"
"C:\Program Files\Microsoft Games\Age of Mythology\aomx.exe"="C:\Program Files\Microsoft Games\Age of Mythology\aomx.exe:*:Enabled:Age of Mythology - The Titans Expansion"
"C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat"="C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:*:Enabled:La Bataille pour la Terre du Milieu T II"
"C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\patchget.dat"="C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\patchget.dat:*:Enabled:patchgrabber"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Midway Games\Rise and Fall\RiseAndFall.exe"="C:\Program Files\Midway Games\Rise and Fall\RiseAndFall.exe:*:Enabled:Rise and Fall: Civilizations at War"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe"="C:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:*:Enabled:Battlefield 2"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"D:\Program Files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe"="D:\Program Files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe:*:Enabled:Dungeon Siege 2 Game Executable"
"C:\Program Files\Steam\SteamApps\thebzh\dark messiah might and magic multi-player\mm.exe"="C:\Program Files\Steam\SteamApps\thebzh\dark messiah might and magic multi-player\mm.exe:*:Disabled:mm"
"C:\Program Files\LucasArts\Star Wars Jedi Knight Jedi Academy\GameData\jamp.exe"="C:\Program Files\LucasArts\Star Wars Jedi Knight Jedi Academy\GameData\jamp.exe:*:Enabled:Jedi Academy MultiPlayer"
"D:\Program Files\LucasArts\Star Wars Galactic Battlegrounds\Game\Battlegrounds.exe"="D:\Program Files\LucasArts\Star Wars Galactic Battlegrounds\Game\Battlegrounds.exe:*:Enabled:Star Wars Galactic Battlegrounds"
"D:\Program Files\Timeline Interactive\Cellfactor Revolution\System\Reality.exe"="D:\Program Files\Timeline Interactive\Cellfactor Revolution\System\Reality.exe:*:Enabled:Reality"
"C:\Program Files\LucasArts\Star Wars Battlefront II\GameData\BattlefrontII.exe"="C:\Program Files\LucasArts\Star Wars Battlefront II\GameData\BattlefrontII.exe:*:Enabled:BattlefrontII"
"D:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe"="D:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe:*:Enabled:DarkCrusade"
"C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD"="C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD:*:Enabled:Age of Empires II"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"D:\Program Files\Diablo II\Game.exe"="D:\Program Files\Diablo II\Game.exe:*:Enabled:Diablo II"
"C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.icd"="C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.icd:*:Enabled:Age of Empires II Expansion"
"C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe"="C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe:*:Enabled:Rise Of Legends"
"D:\Valve\Condition Zero\czero.exe"="D:\Valve\Condition Zero\czero.exe:*:Enabled:Condition Zero Launcher"
"D:\t‚l‚chargement\dofus\Dofus.exe"="D:\t‚l‚chargement\dofus\Dofus.exe:*:Enabled:Dofus"
"C:\Program Files\Bullfrog\Populous Demo\D3DPopTBDemo.exe"="C:\Program Files\Bullfrog\Populous Demo\D3DPopTBDemo.exe:*:Enabled:D3Ddpop3w"
"D:\Program Files\Ubisoft\Demo\Ghost Recon Advanced Warfighter Demo\GRAW_demo.exe"="D:\Program Files\Ubisoft\Demo\Ghost Recon Advanced Warfighter Demo\GRAW_demo.exe:*:Enabled:GRAW_demo"
"D:\CH\RelicCOH.exe"="D:\CH\RelicCOH.exe:*:Enabled:RelicCOH"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Ra2\Ra2\GAME.EXE"="C:\Program Files\Ra2\Ra2\GAME.EXE:*:Enabled:Main executable for Red Alert 2"
"D:\Program Files\Warcraft III\Warcraft III.exe"="D:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\games\RedFaction\RedFaction.exe"="C:\games\RedFaction\RedFaction.exe:*:Enabled:Red Faction Launcher"
"C:\games\RedFaction\RF.exe"="C:\games\RedFaction\RF.exe:*:Enabled:Red Faction"
"D:\Program Files\VideoLAN\VLC\vlc.exe"="D:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"D:\WoW\World of Warcraft\BackgroundDownloader.exe"="D:\WoW\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Benjamin\Bureau\Warcraft III.exe"="C:\Documents and Settings\Benjamin\Bureau\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\CH\BugReport\BugReport.exe"="D:\CH\BugReport\BugReport.exe:*:Enabled:BugReport"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Sierra\Homeworld2\Bin\Release\Homeworld2.exe"="C:\Program Files\Sierra\Homeworld2\Bin\Release\Homeworld2.exe:*:Enabled:Homeworld2"
"C:\games\RedFaction\PF.exe"="C:\games\RedFaction\PF.exe:*:Enabled:PF"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\EA GAMES\Battlefield 2 Server\bf2_w32ded.exe"="C:\Program Files\EA GAMES\Battlefield 2 Server\bf2_w32ded.exe:*:Enabled:bf2_w32ded"
"D:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="D:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"D:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe"="D:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:*:Enabled:Battlefield 2"
"C:\WINDOWS\system32\drivers\svchost.exe"="C:\WINDOWS\system32\drivers\svchost.exe:*:Enabled:svchost"
"D:\Program Files\Dungeon Siege\DungeonSiege.exe"="D:\Program Files\Dungeon Siege\DungeonSiege.exe:*:Enabled:Dungeon Siege Game Executable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:enabled:Assistance … distance"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:enabled:Windows Messenger"
"C:\Program Files\AOL 9.0\AOL.exe"="C:\Program Files\AOL 9.0\AOL.exe:*:enabled:AOL 9.0"
"C:\Program Files\AOL 9.0\WAOL.exe"="C:\Program Files\AOL 9.0\WAOL.exe:*:enabled:AOL 9.0"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLACSD.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLACSD.exe:*:enabled:AOL 9.0 (Connectivity Service)"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDIAL.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDIAL.exe:*:enabled:AOL 9.0 (Connectivity Service Dialer)"
"C:\WINDOWS\system32\fxsclnt.exe"="C:\WINDOWS\system32\fxsclnt.exe:*:enabled:Microsoft Fax"
"C:\Program Files\CA\eTrust Antivirus\InocIT.exe"="C:\Program Files\CA\eTrust Antivirus\InocIT.exe:*:enabled:eTrust Antivirus - Local Scanner"
"C:\Program Files\CA\eTrust Antivirus\Realmon.exe"="C:\Program Files\CA\eTrust Antivirus\Realmon.exe:*:enabled:eTrust Antivirus - Realtime monitor"
"C:\Program Files\CA\eTrust Antivirus\InoRpc.exe"="C:\Program Files\CA\eTrust Antivirus\InoRpc.exe:*:enabled:eTrust Antivirus - RPC Server"
"C:\Program Files\NetMeeting\Conf.exe"="C:\Program Files\NetMeeting\Conf.exe:*:enabled:NetMeeting"
"C:\Program Files\Ahead\Nero MediaHome\NeroMediaHome.exe"="C:\Program Files\Ahead\Nero MediaHome\NeroMediaHome.exe:*:enabled:Nero MediaHome"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:


[b]Finished![/b]

===>>> Pour malaware:

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1180
Windows 5.1.2600 Service Pack 2

20/09/2008 19:02:59
mbam-log-2008-09-20 (19-02-59).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 204607
Temps écoulé: 2 hour(s), 54 minute(s), 56 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 18

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	dssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE	dss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Mirar (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: system32\ -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefoxegxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers	dssserv.sys (Trojan.Agent) -> Delete on reboot.

Ben1er · Answer

voilà le rapport

   -----------\  ToolBar S&D 1.2.0   XP/Vista


   "C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
   Option : [1] ( 20/09/2008|23:26 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\DAEMON Tools Toolbar
   C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   C:\Program Files\DAEMON Tools Toolbar\Resources
   C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml

   -----------\  Extensions

   (Benjamin) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (Benjamin) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

   (LocalService) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 20/09/2008|23:28 - Option : [1]

   -----------\  Fin du rapport a 23:28:05,93

merci pour ton aide

Ben1er · Answer

Bonjour à toi voici le rapport demandé :


   -----------\  ToolBar S&D 1.2.0   XP/Vista


   "C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
   Option : [2] ( 21/09/2008|11:40 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
   Supprime! - C:\Program Files\DAEMON Tools Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (Benjamin) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (Benjamin) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

   (LocalService) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 20/09/2008|23:28 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 21/09/2008|11:44 - Option : [2]

   -----------\  Fin du rapport a 11:44:08,96

Ben1er · Answer

Alors il n’a pas trouvé d’infection et à crée ça :

[C:\WINDOWS\system32\winchat.exe] 2A99260794224489F29B628717B7947E
[C:\WINDOWS\system32\WinFXDocObj.exe] 660336AD0305C852122C5EEBBACE9BAF
[C:\WINDOWS\system32\winhlp32.exe] 577624F19D0441C9111F2AF26C81E04D
[C:\WINDOWS\system32\winlogon.exe] D2DE785AEAB0BB8CA4C14A8A199DBE4E
[C:\WINDOWS\system32\winmine.exe] EA682C022F7204CC8E8C9EF5DCE29356
[C:\WINDOWS\system32\winmsd.exe] 7EBF8A4B608AFB79C67F4E4A9C5885BB
[C:\WINDOWS\system32\winspool.exe] 0B4B94B78123E8035B84105BC024F9F8
[C:\WINDOWS\system32\winver.exe] CE30DCEF79B94D17A8B3BEC26FEF90A3

Et aussi ça:

winchat.exe
WinFXDocObj.exe
winhlp32.exe
winlogon.exe
winmine.exe
winmsd.exe
winspool.exe
winver.exe

Ben1er · Answer

Coucou voilà le rapport j'ai fait CCleaner mais sa bug toujours ....

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\TB.txt: trouvé !
C:\SDFIX: trouvé !
C:\FixWareOut: trouvé !
C:\MsnFix: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Benjamin\Bureau\HijackThis.lnk: trouvé !
C:\MSNFix\MsnFix: trouvé !
C:\Program Files\Microsoft Games\Age of Mythology\history\units\avenger.txt: trouvé !
C:\Program Files\Microsoft Games\Age of Mythology\history2\units\avenger.txt: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Benjamin\Bureau\HijackThis.lnk: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\Microsoft Games\Age of Mythology\history\units\avenger.txt: supprimé !
C:\Program Files\Microsoft Games\Age of Mythology\history2\units\avenger.txt: supprimé !
C:\WINDOWS\msnfix.txt: supprimé !
C:\SDFIX: supprimé !
C:\FixWareOut: supprimé !
C:\MsnFix: supprimé !
C:\Toolbar SD: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !

Ben1er · Answer

Alors tout d’abord ce fichier revient à chaque fois … 


C:\WINDOWS\Internet Logs\ZALog.txt

Et ceux la a chaque analyse de registre ils sont là…

Icone par Défaut Invalide	D:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe,-279	HKCR\ZAMailSafe\DefaultIcon
Ouvrir avec une Application Inexistante	"D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" -warning "%1"	HKCR\ZAMailSafe\shell\open

Le rapport Hijackthis est :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:29, on 21/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\PC Accelerator 2007\deskxl.exe
D:\Program Files\PC Accelerator 2007\pcperf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.carrefour.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {7141E838-7BE0-F63D-6939-29A2CC9FBB15} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeskAccelerator] "D:\Program Files\PC Accelerator 2007\deskxl.exe"
O4 - HKLM\..\Run: [PCPerf] "D:\Program Files\PC Accelerator 2007\pcperf.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour.fr/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Ben1er · Answer

Bon c'est long alors je poste sa avant.

Quand j’attends un certain temps je ne peux plus accéder à internet et mozilla marque :

Délai d'attente dépassé

« Le serveur à l'adresse www.google.fr met trop de temps à répondre.

Le navigateur a attendu trop longtemps lors de la connexion au site et a arrêté d'attendre une réponse.

    * Le serveur est peut-être en surcharge ou est temporairement en panne ? Réessayez plus tard.
    * D'autres sites sont aussi inaccessibles ? Vérifiez la connexion au réseau de votre ordinateur.
    * Votre ordinateur ou votre réseau est-il protégé par un pare-feu ou un proxy ? Des paramètres incorrects peuvent interférer avec la navigation sur le Web.
    * Vous avez toujours des problèmes ? Consultez votre administrateur réseau ou votre fournisseur d'accès à Internet pour obtenir de l'aide. »

Ben1er · Answer

Voilà le log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:49:23, on 21/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\PC Accelerator 2007\deskxl.exe
D:\Program Files\PC Accelerator 2007\pcperf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.carrefour.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeskAccelerator] "D:\Program Files\PC Accelerator 2007\deskxl.exe"
O4 - HKLM\..\Run: [PCPerf] "D:\Program Files\PC Accelerator 2007\pcperf.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour.fr/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Ben1er · Answer

Voilà le log: ComboFix 08-09-20.05 - Benjamin 2008-09-21 20:43:52.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1545 [GMT 2:00] Lancé depuis: D: ‚l‚chargement\mise a jour systŠme\ComboFix.exe * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 )))))))))))))))))))))))))))))))))))) . 2008-09-21 19:02 . 2008-09-21 19:02 d-------- C:\Program Files\Trend Micro 2008-09-21 12:03 . 2008-09-21 12:36 d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-09-21 11:56 . 2008-09-21 11:56 d-------- C:\Program Files\EzGenerator28 2008-09-21 11:56 . 2008-09-21 11:56 40 --a------ C:\WINDOWS\iltwain.ini 2008-09-20 23:26 . 2008-09-21 11:43 2,362 --a------ C:\Documents and Settings\Orph.egd 2008-09-20 19:48 . 2008-09-21 18:29 d-------- C:\WINDOWS\ERUNT 2008-09-20 19:48 . 2008-09-20 21:25 d-------- C:\Backups 2008-09-20 19:05 . 2008-09-21 18:33 5,060 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-20 11:11 . 2008-09-20 11:11 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot 2008-09-20 11:02 . 2008-09-20 11:02 d-------- C:\Documents and Settings\Benjamin\Application Data\Malwarebytes 2008-09-20 11:02 . 2008-09-20 11:02 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-20 11:02 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-20 11:02 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-20 00:31 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-09-20 00:31 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-09-20 00:31 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-09-20 00:31 . 2008-09-02 16:51 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-09-20 00:31 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-09-20 00:31 . 2008-09-19 12:26 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-09-20 00:31 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-09-20 00:31 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-09-20 00:31 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-09-20 00:31 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-09-19 20:12 . 2008-09-19 20:12 d-------- C:\Documents and Settings\NetworkService\Application Data\X10 Commander 2008-09-18 22:31 . 2008-09-18 22:31 d-------- C:\Documents and Settings\Benjamin\Application Data\Lavasoft 2008-09-18 22:30 . 2008-09-18 22:30 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-09-18 22:30 . 2008-09-18 22:30 d-------- C:\Documents and Settings\Benjamin\Application Data\PC Tools 2008-09-18 22:30 . 2008-09-18 22:30 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-09-18 22:30 . 2008-09-20 22:24 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-18 22:29 . 2008-09-18 22:29 d-------- C:\Documents and Settings\Benjamin\Application Data\Webroot 2008-09-18 22:26 . 2008-09-18 22:27 d-------- C:\Temp 2008-09-18 22:26 . 2008-09-18 22:26 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-09-18 22:06 . 2008-09-18 22:06 d-------- C:\WINDOWS\system32\GroupPolicy 2008-09-17 17:49 . 2008-09-18 22:05 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-16 18:30 . 2008-09-16 18:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-16 18:30 . 2008-09-16 18:30 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-14 21:03 . 2008-09-16 18:27 512 --a------ C:\ScanSectorLog.dat 2008-09-14 20:54 . 2008-09-14 20:54 d-------- C:\Documents and Settings\Benjamin\Application Data\MailFrontier 2008-09-13 11:22 . 2008-09-14 21:52 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-09-13 11:22 . 2008-09-16 18:25 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-09-13 11:21 . 2008-09-21 18:33 161,824 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-13 11:21 . 2008-09-13 11:21 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-09-13 11:21 . 2007-06-21 21:54 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-09-13 11:21 . 2008-09-13 11:21 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-09-13 11:21 . 2007-06-21 21:55 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll 2008-09-13 11:21 . 2007-06-21 21:55 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll 2008-09-13 11:21 . 2007-06-21 21:55 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll 2008-09-13 11:21 . 2007-06-21 21:55 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll 2008-09-13 11:19 . 2008-09-17 17:01 d-------- C:\WINDOWS\Internet Logs 2008-09-06 15:03 . 2008-09-06 15:04 d-------- C:\Documents and Settings\Benjamin\Application Data\SPORE 2008-08-23 11:42 . 2008-08-23 11:43 d-------- C:\WINDOWS\NV11881272.TMP 2008-08-23 11:42 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32 vapps.nvb 2008-08-23 11:41 . 2008-08-23 11:41 d-------- C:\NVIDIA . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-21 10:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-19 20:10 --------- d-----w C:\Program Files\AdvancedAdvisor 2008-09-17 15:53 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-09-17 15:00 2,899,968 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp 2008-09-16 21:37 77,312 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2008-09-16 17:21 --------- d-----w C:\Program Files\Steam 2008-09-16 17:07 379,392 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2008-09-16 17:07 1,723,904 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2008-09-06 13:03 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-25 09:36 81,288 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys 2008-08-25 09:36 66,952 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys 2008-08-25 09:36 40,840 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-08-20 19:00 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-20 18:49 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-08-16 16:40 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-08-16 15:13 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-08-16 15:13 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\DAEMON Tools 2008-07-24 08:15 --------- d-----w C:\Program Files\GUILD WARS 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll 2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2006-12-10 20:45 1 ----a-w C:\Documents and Settings\Benjamin\SI.bin 2006-05-29 14:40 7,296,000 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288] "ccleaner"="D:\Program Files\CCleaner\CCleaner.exe" [2008-08-22 1234160] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088] "DeskAccelerator"="D:\Program Files\PC Accelerator 2007\deskxl.exe" [2006-12-05 106496] "PCPerf"="D:\Program Files\PC Accelerator 2007\pcperf.exe" [2006-12-06 151552] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 266497] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016] "UnlockerAssistant"="D:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32 wiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoSecCPL"= 0 (0x0) "NoConfigPage"= 0 (0x0) "NoVirtMemPage"= 0 (0x0) "NoDevMgrPage"= 0 (0x0) "DisableLockWorkstation"= 0 (0x0) "NoCommonGroups"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) "NoChangeAnimation"= 1 (0x1) "NoStrCmpLogical"= 1 (0x1) "NoChangeKeyboardNavigationIndicators"= 0 (0x0) "NoSMConfigurePrograms"= 0 (0x0) "LockTaskbar"= 0 (0x0) "NoUserNameInStartMenu"= 0 (0x0) "NoStartMenuEjectPC"= 0 (0x0) "ForceStartMenuLogoff"= 0 (0x0) "NoRecentDocsNetHood"= 0 (0x0) "DisableMyPicturesDirChange"= 0 (0x0) "DisableMyMusicDirChange"= 0 (0x0) "DisableFavoritesDirChange"= 0 (0x0) "GreyMSIAds"= 0 (0x0) "NoStartMenuPinnedList"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoStrCmpLogical"= 1 (0x1) "NoFavoritesMenu"= 0 (0x0) "NoLogOff"= 0 (0x0) "NoInstrumentation"= 0 (0x0) "NoFileUrl"= 0 (0x0) "NoSimpleStartMenu"= 0 (0x0) "NoStartMenuMFUprogramsList"= 0 (0x0) "NoDFSTab"= 0 (0x0) "NoResolveSearch"= 0 (0x0) "NoSMConfigurePrograms"= 0 (0x0) "LockTaskbar"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\WB] 2001-12-20 23:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^CONNECTAUTrayApp.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 17:02 490952 C:\Program Files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-10-25 19:58 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-03-29 10:20 1271032 C:\Program Files\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\WINDOWS\system32\sessmgr.exe"= "C:\WINDOWS\system32\fxsclnt.exe"= "C:\Program Files\NetMeeting\Conf.exe"= "C:\Program Files\Ahead\Nero MediaHome\NeroMediaHome.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe"= "C:\Program Files\Ubisoft\Tom Clancy's Splinter Cell Chaos Theory\System\splintercell3.exe"= "C:\Program Files\JVTorrent\btdownloadgui.exe"= "C:\Program Files\Microsoft Games\Age of Empires III\age3.exe"= "C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE"= "C:\Program Files\Atari\Act of War - Direct Action\fpupdate.exe"= "C:\WINDOWS\system32\dpnsvr.exe"= "C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat"= "C:\Program Files\Microsoft Games\Age of Mythology\aomx.exe"= "C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat"= "C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\patchget.dat"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\Midway Games\Rise and Fall\RiseAndFall.exe"= "C:\Program Files\LimeWire\LimeWire.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"= "D:\Program Files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe"= "C:\Program Files\Steam\SteamApps\thebzh\dark messiah might and magic multi-player\mm.exe"= "C:\Program Files\LucasArts\Star Wars Jedi Knight Jedi Academy\GameData\jamp.exe"= "D:\Program Files\LucasArts\Star Wars Galactic Battlegrounds\Game\Battlegrounds.exe"= "D:\Program Files\Timeline Interactive\Cellfactor Revolution\System\Reality.exe"= "C:\Program Files\LucasArts\Star Wars Battlefront II\GameData\BattlefrontII.exe"= "D:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe"= "C:\WINDOWS\system32\dplaysvr.exe"= "D:\Program Files\Diablo II\Game.exe"= "C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe"= "D:\Valve\Condition Zero\czero.exe"= "C:\Program Files\Bullfrog\Populous Demo\D3DPopTBDemo.exe"= "D:\Program Files\Ubisoft\Demo\Ghost Recon Advanced Warfighter Demo\GRAW_demo.exe"= "D:\CH\RelicCOH.exe"= "C:\Program Files\Steam\Steam.exe"= "C:\Program Files\Ra2\Ra2\GAME.EXE"= "D:\Program Files\Warcraft III\Warcraft III.exe"= "C:\games\RedFaction\RedFaction.exe"= "C:\games\RedFaction\RF.exe"= "D:\Program Files\VideoLAN\VLC\vlc.exe"= "D:\WoW\World of Warcraft\BackgroundDownloader.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= "D:\CH\BugReport\BugReport.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Sierra\Homeworld2\Bin\Release\Homeworld2.exe"= "C:\games\RedFaction\PF.exe"= "C:\Program Files\Electronic Arts\EADM\Core.exe"= "C:\Program Files\EA GAMES\Battlefield 2 Server\bf2_w32ded.exe"= "D:\Program Files\EA GAMES\Battlefield 2\BF2.exe"= "D:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe"= "D:\Program Files\Dungeon Siege\DungeonSiege.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R2 WUSB54Gv4SVC;WUSB54Gv4SVC;C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe WUSB54Gv4.exe [ ] R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-06 826752] R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2005-05-12 1287296] R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 7040] S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-29 10664] S3 kbeepm;kbeepm;C:\DOCUME~1\Benjamin\LOCALS~1\Temp\kbeepm.sys [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3214368a-3767-11db-a49b-0014bf74de62}] \Shell\AutoRun\command - J:\setupSNK.exe *Newly Created Service* - PROCEXP90 . Contenu du dossier 'Tâches planifiées' . - - - - ORPHELINS SUPPRIMES - - - - Notify-AtiExtEvent - (no file) . ------- Examen supplémentaire ------- . FireFox -: Profile - C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\sa2vws61.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser ppdf32.dll FF -: plugin - C:\Program Files\DivX\DivX Content Uploader pUpload.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins pmozax.dll FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology pViewpoint.dll FF -: plugin - C:\Program Files\Yahoo!\Common pyaxmpb.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 20:47:28 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-09-21 20:48:50 ComboFix-quarantined-files.txt 2008-09-21 18:48:45 Avant-CF: 13ÿ545ÿ725ÿ952 octets libres Après-CF: 13,534,375,936 octets libres 278 --- E O F --- 2008-09-19 16:00:28

Ben1er · Answer

Désoler de rentrer que maintenant mais j'ai repris et je ne suis plus chez moi la journée donc je te répond en te disant que sa ne fonctionne toujours pas .... désolé...

Ben1er · Answer

ok si sa peut vous aider je vient de voir que msn marche et Outlook aussi alors que mozilla et internet explorer non... quand je veux regarder mes emails de mon adresse msn sa me lance la page pour mettre mon mot de passe sur internet explorer et après sa bug et sa affiche se que je disait plus haut .... voilà bon courage...

Utilisateur anonyme · Answer

Salut,

Copie le texte ci-dessous : 

File:: 
C:\WINDOWS\iltwain.ini 
C:\WINDOWS\system32\VCCLSID.exe 
C:\WINDOWS\system32\SrchSTS.exe 
C:\WINDOWS\system32\AntiXPVSTFix.exe 
C:\WINDOWS\system32\VACFix.exe 
C:\WINDOWS\system32\IEDFix.exe 
C:\WINDOWS\system32\IEDFix.C.exe 
C:\WINDOWS\system32\404Fix.exe 
C:\WINDOWS\system32\Process.exe 
C:\WINDOWS\system32\dumphive.exe 
C:\WINDOWS\system32\WS2Fix.exe 
C:\WINDOWS\NV11881272.TMP 
C:\WINDOWS\system32
vapps.nvb 
C:\DOCUME~1\Benjamin\LOCALS~1\Temp\kbeepm.sys 

Folder:: 
C:\WINDOWS\ERUNT 

Registry:: 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 
"AppInit_DLLs"=""

Driver::
kbeepm

DirLook:: 
C:\Temp

FileLook:: 
C:\WINDOWS\system32\vsutil_loc040c.dll 
C:\WINDOWS\zllsputility_loc040c.dll 
C:\WINDOWS\system32\imsinstall_loc040c.dll 


Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci : 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

S'il n'y a pas de rédémarrage, poste quand même les rapports.

Ben1er · Answer

Voilà pour combofix : ComboFix 08-09-20.05 - Benjamin 2008-09-22 21:54:56.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1547 [GMT 2:00] Lancé depuis: D:\t‚l‚chargement\mise a jour systŠme\ComboFix.exe Commutateurs utilisés :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt * Un nouveau point de restauration a été créé * Resident AV is active [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\DOCUME~1\Benjamin\LOCALS~1\Temp\kbeepm.sys C:\WINDOWS\iltwain.ini C:\WINDOWS\NV11881272.TMP C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\AntiXPVSTFix.exe C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\nvapps.nvb C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\ERUNT C:\WINDOWS\ERUNT\SDFIX\default C:\WINDOWS\ERUNT\SDFIX\ERDNT.CON C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE C:\WINDOWS\ERUNT\SDFIX\ERDNT.INF C:\WINDOWS\ERUNT\SDFIX\ERDNTDOS.LOC C:\WINDOWS\ERUNT\SDFIX\ERDNTWIN.LOC C:\WINDOWS\ERUNT\SDFIX\Find.txt C:\WINDOWS\ERUNT\SDFIX\report.txt C:\WINDOWS\ERUNT\SDFIX\SAM C:\WINDOWS\ERUNT\SDFIX\SECURITY C:\WINDOWS\ERUNT\SDFIX\software C:\WINDOWS\ERUNT\SDFIX\system C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat C:\WINDOWS\ERUNT\SDFIX_First_Run\default C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.CON C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.INF C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNTDOS.LOC C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNTWIN.LOC C:\WINDOWS\ERUNT\SDFIX_First_Run\SAM C:\WINDOWS\ERUNT\SDFIX_First_Run\SECURITY C:\WINDOWS\ERUNT\SDFIX_First_Run\software C:\WINDOWS\ERUNT\SDFIX_First_Run\system C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat C:\WINDOWS\iltwain.ini C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\AntiXPVSTFix.exe C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\nvapps.nvb C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_KBEEPM -------\Service_kbeepm ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-22 au 2008-09-22 )))))))))))))))))))))))))))))))))))) . 2008-09-21 19:02 . 2008-09-21 19:02 d-------- C:\Program Files\Trend Micro 2008-09-21 12:03 . 2008-09-21 12:36 d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-09-21 11:56 . 2008-09-21 11:56 d-------- C:\Program Files\EzGenerator28 2008-09-20 23:26 . 2008-09-21 11:43 2,362 --a------ C:\Documents and Settings\Orph.egd 2008-09-20 19:48 . 2008-09-20 21:25 d-------- C:\Backups 2008-09-20 19:05 . 2008-09-22 21:37 5,996 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-20 11:11 . 2008-09-20 11:11 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot 2008-09-20 11:02 . 2008-09-20 11:02 d-------- C:\Documents and Settings\Benjamin\Application Data\Malwarebytes 2008-09-20 11:02 . 2008-09-20 11:02 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-20 11:02 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-20 11:02 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-19 20:12 . 2008-09-19 20:12 d-------- C:\Documents and Settings\NetworkService\Application Data\X10 Commander 2008-09-18 22:31 . 2008-09-18 22:31 d-------- C:\Documents and Settings\Benjamin\Application Data\Lavasoft 2008-09-18 22:30 . 2008-09-18 22:30 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2008-09-18 22:30 . 2008-09-18 22:30 d-------- C:\Documents and Settings\Benjamin\Application Data\PC Tools 2008-09-18 22:30 . 2008-09-18 22:30 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2008-09-18 22:30 . 2008-09-20 22:24 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-18 22:29 . 2008-09-18 22:29 d-------- C:\Documents and Settings\Benjamin\Application Data\Webroot 2008-09-18 22:26 . 2008-09-18 22:27 d-------- C:\Temp 2008-09-18 22:26 . 2008-09-18 22:26 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-09-18 22:06 . 2008-09-18 22:06 d-------- C:\WINDOWS\system32\GroupPolicy 2008-09-17 17:49 . 2008-09-18 22:05 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-16 18:30 . 2008-09-16 18:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-16 18:30 . 2008-09-16 18:30 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-14 21:03 . 2008-09-16 18:27 512 --a------ C:\ScanSectorLog.dat 2008-09-14 20:54 . 2008-09-14 20:54 d-------- C:\Documents and Settings\Benjamin\Application Data\MailFrontier 2008-09-13 11:22 . 2008-09-14 21:52 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-09-13 11:22 . 2008-09-16 18:25 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-09-13 11:21 . 2008-09-22 22:02 262,176 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-13 11:21 . 2008-09-13 11:21 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-09-13 11:21 . 2007-06-21 21:54 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-09-13 11:21 . 2008-09-13 11:21 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-09-13 11:21 . 2007-06-21 21:55 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll 2008-09-13 11:21 . 2007-06-21 21:55 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll 2008-09-13 11:21 . 2007-06-21 21:55 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll 2008-09-13 11:21 . 2007-06-21 21:55 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll 2008-09-13 11:19 . 2008-09-17 17:01 d-------- C:\WINDOWS\Internet Logs 2008-09-06 15:03 . 2008-09-06 15:04 d-------- C:\Documents and Settings\Benjamin\Application Data\SPORE 2008-08-23 11:42 . 2008-08-23 11:43 d-------- C:\WINDOWS\NV11881272.TMP 2008-08-23 11:41 . 2008-08-23 11:41 d-------- C:\NVIDIA . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-21 10:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-19 20:10 --------- d-----w C:\Program Files\AdvancedAdvisor 2008-09-17 15:53 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-09-16 17:21 --------- d-----w C:\Program Files\Steam 2008-08-25 09:36 81,288 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys 2008-08-25 09:36 66,952 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys 2008-08-25 09:36 40,840 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-08-20 19:00 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-16 16:40 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-08-16 15:13 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-08-16 15:13 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\DAEMON Tools 2008-07-24 08:15 --------- d-----w C:\Program Files\GUILD WARS 2006-12-10 20:45 1 ----a-w C:\Documents and Settings\Benjamin\SI.bin 2006-05-29 14:40 7,296,000 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- C:\WINDOWS\system32\imsinstall_loc040c.dll ---- Company: Zone Labs, Inc. File Description: Programme d installation fournisseur ZoneAlarm IMsecure LSP File Version: 1, 5, 0, 31 Product Name: IMsecure Pro Copyright: Copyright (c) 1998-2004, Zone Labs, Inc. Original file name: imsinstall.dll MD5: 88eb5d448cea1dcc196cedcd01426aa5 ---- C:\WINDOWS\system32\vsutil_loc040c.dll ---- Company: Zone Labs Inc. File Description: TrueVector Service File Version: 5.3.017.000 Product Name: TrueVector Service Copyright: Copyright ¸ 1998-2004, Zone Labs Inc. Original file name: vsutil.dll MD5: d4b23a1d3197398f9fdde32cda405fd3 ---- C:\WINDOWS\zllsputility_loc040c.dll ---- Company: Zone Labs Inc. File Description: Utilitaire de suppression LSP de ZoneLabs File Version: 5.3.017.000 Product Name: Utilitaire de suppression LSP de ZoneLabs Copyright: Copyright ¸ 1998-2004, Zone Labs Inc. Original file name: zllsputility.exe MD5: 19fb9b083b75a83b06faf1d3068a3001 ---- Directory of C:\Temp ---- ((((((((((((((((((((((((((((( snapshot@2008-09-21_20.48.20.01 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288] "ccleaner"="D:\Program Files\CCleaner\CCleaner.exe" [2008-08-22 1234160] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088] "DeskAccelerator"="D:\Program Files\PC Accelerator 2007\deskxl.exe" [2006-12-05 106496] "PCPerf"="D:\Program Files\PC Accelerator 2007\pcperf.exe" [2006-12-06 151552] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 266497] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016] "UnlockerAssistant"="D:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoSecCPL"= 0 (0x0) "NoConfigPage"= 0 (0x0) "NoVirtMemPage"= 0 (0x0) "NoDevMgrPage"= 0 (0x0) "DisableLockWorkstation"= 0 (0x0) "NoCommonGroups"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"= 1 (0x1) "AllowUnhashedWebView"= 1 (0x1) "NoChangeAnimation"= 1 (0x1) "NoStrCmpLogical"= 1 (0x1) "NoChangeKeyboardNavigationIndicators"= 0 (0x0) "NoSMConfigurePrograms"= 0 (0x0) "LockTaskbar"= 0 (0x0) "NoUserNameInStartMenu"= 0 (0x0) "NoStartMenuEjectPC"= 0 (0x0) "ForceStartMenuLogoff"= 0 (0x0) "NoRecentDocsNetHood"= 0 (0x0) "DisableMyPicturesDirChange"= 0 (0x0) "DisableMyMusicDirChange"= 0 (0x0) "DisableFavoritesDirChange"= 0 (0x0) "GreyMSIAds"= 0 (0x0) "NoStartMenuPinnedList"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoStrCmpLogical"= 1 (0x1) "NoFavoritesMenu"= 0 (0x0) "NoLogOff"= 0 (0x0) "NoInstrumentation"= 0 (0x0) "NoFileUrl"= 0 (0x0) "NoSimpleStartMenu"= 0 (0x0) "NoStartMenuMFUprogramsList"= 0 (0x0) "NoDFSTab"= 0 (0x0) "NoResolveSearch"= 0 (0x0) "NoSMConfigurePrograms"= 0 (0x0) "LockTaskbar"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 23:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^CONNECTAUTrayApp.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 17:02 490952 C:\Program Files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-10-25 19:58 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-03-29 10:20 1271032 C:\Program Files\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\WINDOWS\system32\sessmgr.exe"= "C:\WINDOWS\system32\fxsclnt.exe"= "C:\Program Files\NetMeeting\Conf.exe"= "C:\Program Files\Ahead\Nero MediaHome\NeroMediaHome.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe"= "C:\Program Files\Ubisoft\Tom Clancy's Splinter Cell Chaos Theory\System\splintercell3.exe"= "C:\Program Files\JVTorrent\btdownloadgui.exe"= "C:\Program Files\Microsoft Games\Age of Empires III\age3.exe"= "C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE"= "C:\Program Files\Atari\Act of War - Direct Action\fpupdate.exe"= "C:\WINDOWS\system32\dpnsvr.exe"= "C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat"= "C:\Program Files\Microsoft Games\Age of Mythology\aomx.exe"= "C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat"= "C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\patchget.dat"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\Midway Games\Rise and Fall\RiseAndFall.exe"= "C:\Program Files\LimeWire\LimeWire.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"= "D:\Program Files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe"= "C:\Program Files\Steam\SteamApps\thebzh\dark messiah might and magic multi-player\mm.exe"= "C:\Program Files\LucasArts\Star Wars Jedi Knight Jedi Academy\GameData\jamp.exe"= "D:\Program Files\LucasArts\Star Wars Galactic Battlegrounds\Game\Battlegrounds.exe"= "D:\Program Files\Timeline Interactive\Cellfactor Revolution\System\Reality.exe"= "C:\Program Files\LucasArts\Star Wars Battlefront II\GameData\BattlefrontII.exe"= "D:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe"= "C:\WINDOWS\system32\dplaysvr.exe"= "D:\Program Files\Diablo II\Game.exe"= "C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe"= "D:\Valve\Condition Zero\czero.exe"= "C:\Program Files\Bullfrog\Populous Demo\D3DPopTBDemo.exe"= "D:\Program Files\Ubisoft\Demo\Ghost Recon Advanced Warfighter Demo\GRAW_demo.exe"= "D:\CH\RelicCOH.exe"= "C:\Program Files\Steam\Steam.exe"= "C:\Program Files\Ra2\Ra2\GAME.EXE"= "D:\Program Files\Warcraft III\Warcraft III.exe"= "C:\games\RedFaction\RedFaction.exe"= "C:\games\RedFaction\RF.exe"= "D:\Program Files\VideoLAN\VLC\vlc.exe"= "D:\WoW\World of Warcraft\BackgroundDownloader.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= "D:\CH\BugReport\BugReport.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Sierra\Homeworld2\Bin\Release\Homeworld2.exe"= "C:\games\RedFaction\PF.exe"= "C:\Program Files\Electronic Arts\EADM\Core.exe"= "C:\Program Files\EA GAMES\Battlefield 2 Server\bf2_w32ded.exe"= "D:\Program Files\EA GAMES\Battlefield 2\BF2.exe"= "D:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe"= "D:\Program Files\Dungeon Siege\DungeonSiege.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R2 WUSB54Gv4SVC;WUSB54Gv4SVC;C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe WUSB54Gv4.exe [ ] R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-06 826752] R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2005-05-12 1287296] R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 7040] S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-29 10664] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3214368a-3767-11db-a49b-0014bf74de62}] \Shell\AutoRun\command - J:\setupSNK.exe . Contenu du dossier 'Tâches planifiées' . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-22 22:01:02 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- PROCESSUS: C:\WINDOWS\explorer.exe -> D:\Program Files\Unlocker\UnlockerHook.dll . ------------------------ Autres processus actifs ------------------------ . C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe D:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe C:\Program Files\Common Files\X10\Common\X10nets.exe C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Sony\SonicStage\SSAAD.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE . ************************************************************************** . Heure de fin: 2008-09-22 22:05:30 - La machine a redémarré ComboFix-quarantined-files.txt 2008-09-22 20:05:22 ComboFix2.txt 2008-09-21 18:48:51 Avant-CF: 13ÿ512ÿ331ÿ264 octets libres Après-CF: 13,401,161,728 octets libres 351 --- E O F --- 2008-09-19 16:00:28 Pour hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:09:46, on 22/09/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe D:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe C:\WINDOWS\system32\dllhost.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe D:\Program Files\PC Accelerator 2007\deskxl.exe D:\Program Files\PC Accelerator 2007\pcperf.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.carrefour.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DeskAccelerator] "D:\Program Files\PC Accelerator 2007\deskxl.exe" O4 - HKLM\..\Run: [PCPerf] "D:\Program Files\PC Accelerator 2007\pcperf.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: CCC.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour.fr/ O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Fsk\SonySCSIHelperService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing) O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Utilisateur anonyme · Answer

désinstal java car pas a jours et telecharge et instal cette version


ensuite dis nous comment va le pc stp

Ben1er · Answer

désoler mais sa ne marche toujours pas au bout de environ 7 minutes internet ne marche plus sur mozzilla et internet explorer

Utilisateur anonyme · Answer

> Télécharge random's system information tool (RSIT) : http://images.malwareremoval.com/random/RSIT.exe 
- Enregistre le programme sur ton bureau. 
- Double clique sur RSIT.exe 
- Clique sur <continue> à l'écran "Disclaimer". 
- Si HiJackThis n'est pas détecté sur ton PC, RSIT le téléchargera ; accepte alors la licence. 
- Une fois le scanne terminé tu obtiendras un rapport log.txt. Poste le sur le forum. 
NB : Il se peut que tu obtiennes un second rapport nommé info.txt. Dans ce cas poste le aussi.

Ben1er · Answer

Voilà le log:

Logfile of random's system information tool 1.02 (written by random/random)
Run by Benjamin at 2008-09-23 18:00:33
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 13 GB (9%) free of 144 GB
Total RAM: 2046 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:00:47, on 23/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
D:\Program Files\PC Accelerator 2007\deskxl.exe
D:\Program Files\PC Accelerator 2007\pcperf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Benjamin\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Benjamin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.carrefour.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeskAccelerator] "D:\Program Files\PC Accelerator 2007\deskxl.exe"
O4 - HKLM\..\Run: [PCPerf] "D:\Program Files\PC Accelerator 2007\pcperf.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour.fr/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Utilisateur anonyme · Answer

Télécharge cet outil de SiRi: 

http://siri.urz.free.fr/Softs/RHosts.exe
http://siri.urz.free.fr/RHosts.php 

Double cliquer dessus pour l'exécuter 

et cliquer sur " Restore original Hosts " 

ps : c est normal que rien ne se passe puis redémarre le pc et test et dis nous

Ben1er · Answer

désoler mais sa ne marche toujours pas je suis obliger de redémarrer l'ordinateur pour que je puisse de nouveau aller sur internet pendant 6-7 minutes....

Utilisateur anonyme · Answer

ça te le fais avec firefox et IE , ?

depuis quand as tu ce soucis 

je vois : PC Accelerator 2007 y aurait il une coincidence avec son installation ?

Ben1er · Answer

nan pc accelerator 2007 sa fait plus de 4 mois et mon problème date de deux semaine... Alors je raconte l'histoire à un moment donné il y à deux semaines mes pages google étaient redirigés j'ai donc fait des scan antivirus et antispyware mais en vain ensuite j'ai télécharger Zone Alarme mais qui bugguer et donc j'ai essayer de le désinstaller mais sa ne marcher pas je l'ai donc supprimé manuellement avec des logiciels comme fileassassins et unlocker et ensuite le problème persistait....

Ben1er · Answer

Je tient à dire aussi que je peux aller sur msn jouer à guild wars recevoir mes mails (outlook) sans aucun problème...

Ben1er · Answer

Coucou tout le monde je voulais savoir si vous aviez des news pour mon problème @++

Ben1er · Answer

Coucou à tous merci de m'avoir aidé j'ai trouvé la solution du problème: enfaite zone alarme s'était mal désinstallé et bloquait tout le réseau mais maintenant que j'ai supprimé tous les fichiers c'est bon !!!! merci beaucoup de vous être occuper de mon cas !!!

Ben1er · Answer

Bonjour à tous c'est encore moi mon problème est revenu !!!!! Et je ne sait strictement pas pourquoi.... Que faire ????

Redirection page google et blocage connexion - Page 2

Discussions similaires

Newsletters